diff --git a/apertis-ospack-basesdk.yaml b/apertis-ospack-basesdk.yaml index 7f4ceae1e4fc28d19feb910ee292390d2589f8a5..12afe1c0d03b1a91fdb593e128a25c61b15d31e7 100644 --- a/apertis-ospack-basesdk.yaml +++ b/apertis-ospack-basesdk.yaml @@ -546,6 +546,11 @@ actions: chroot: true script: scripts/generate_locales.sh + - action: run + description: Switch the logind AppArmor profile to complain mode + chroot: false + script: scripts/apparmor-profile-switch-to-complain.sh ${ROOTDIR}/etc/apparmor.d/lib.systemd.systemd-logind + # work around the Debos isssue in https://phabricator.apertis.org/T4308 - action: run chroot: false diff --git a/apertis-ospack-minimal.yaml b/apertis-ospack-minimal.yaml index dd2da34ab9b91e56fa74ac783a5169102203246a..ba947f4e96d14800514bf04cff21144aa1153a36 100644 --- a/apertis-ospack-minimal.yaml +++ b/apertis-ospack-minimal.yaml @@ -153,6 +153,21 @@ actions: chroot: true script: scripts/generate_locales.sh + - action: run + description: Switch the logind AppArmor profile to complain mode + chroot: false + script: scripts/apparmor-profile-switch-to-complain.sh ${ROOTDIR}/etc/apparmor.d/lib.systemd.systemd-logind + + - action: run + description: Switch the Canterbury AppArmor profile to complain mode + chroot: false + script: scripts/apparmor-profile-switch-to-complain.sh ${ROOTDIR}/etc/apparmor.d/usr.*.canterbury* + + - action: run + description: Switch the Ribchester AppArmor profile to complain mode + chroot: false + script: scripts/apparmor-profile-switch-to-complain.sh ${ROOTDIR}/etc/apparmor.d/usr.*.ribchester* + # work around the Debos isssue in https://phabricator.apertis.org/T4308 - action: run chroot: false diff --git a/apertis-ospack-sdk.yaml b/apertis-ospack-sdk.yaml index 9095c51f454778e7188ee8c989977ec44d998802..229ab91c93371c675eb10b09611c74219b37533d 100644 --- a/apertis-ospack-sdk.yaml +++ b/apertis-ospack-sdk.yaml @@ -742,6 +742,21 @@ actions: chroot: true script: scripts/generate_locales.sh + - action: run + description: Switch the logind AppArmor profile to complain mode + chroot: false + script: scripts/apparmor-profile-switch-to-complain.sh ${ROOTDIR}/etc/apparmor.d/lib.systemd.systemd-logind + + - action: run + description: Switch the Canterbury AppArmor profile to complain mode + chroot: false + script: scripts/apparmor-profile-switch-to-complain.sh ${ROOTDIR}/etc/apparmor.d/usr.*.canterbury* + + - action: run + description: Switch the Ribchester AppArmor profile to complain mode + chroot: false + script: scripts/apparmor-profile-switch-to-complain.sh ${ROOTDIR}/etc/apparmor.d/usr.*.ribchester* + # work around the Debos isssue in https://phabricator.apertis.org/T4308 - action: run chroot: false diff --git a/apertis-ospack-target.yaml b/apertis-ospack-target.yaml index b8c3e295b7d1f2063026ffdbc3d86561ac7af245..b388738da55d5552eea8bdb642f88a1b811bdd8e 100644 --- a/apertis-ospack-target.yaml +++ b/apertis-ospack-target.yaml @@ -260,6 +260,23 @@ actions: chroot: true script: scripts/generate_locales.sh + - action: run + description: Switch the logind AppArmor profile to complain mode + chroot: false + script: scripts/apparmor-profile-switch-to-complain.sh ${ROOTDIR}/etc/apparmor.d/lib.systemd.systemd-logind + + {{ if eq $ivitools "enabled" }} + - action: run + description: Switch the Canterbury AppArmor profile to complain mode + chroot: false + script: scripts/apparmor-profile-switch-to-complain.sh ${ROOTDIR}/etc/apparmor.d/usr.*.canterbury* + + - action: run + description: Switch the Ribchester AppArmor profile to complain mode + chroot: false + script: scripts/apparmor-profile-switch-to-complain.sh ${ROOTDIR}/etc/apparmor.d/usr.*.ribchester* + {{ end }} + # work around the Debos isssue in https://phabricator.apertis.org/T4308 - action: run chroot: false diff --git a/scripts/apparmor-profile-switch-to-complain.sh b/scripts/apparmor-profile-switch-to-complain.sh new file mode 100755 index 0000000000000000000000000000000000000000..8c8ad0809104fabf00eb57cc152ad5602afe5b16 --- /dev/null +++ b/scripts/apparmor-profile-switch-to-complain.sh @@ -0,0 +1,10 @@ +#!/bin/sh + +set -eu + +for ARG in "$@" +do + PROFILE=$(basename "$ARG") + echo "AppArmor: forcing profile $PROFILE in complain mode" + ln -s "../$PROFILE" "${ROOTDIR}/etc/apparmor.d/force-complain/" +done